Auth bypass in Venturedrake Laravel-Crm
CVE-2026-110629
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/venturedrake/laravel-crm/issues/79 (issue-tracking)
- github.com/venturedrake/laravel-crm/issues/80 (issue-tracking)
- github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02… (technical-description)
- github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02… (technical-description)
- github.com/venturedrake/laravel-crm/commit/1a280cb22fc006f63fb96fe540dc4d651a8f… (patch)
- github.com/venturedrake/laravel-crm/commit/cc41264eff5563f470984b8d2cfcc9ab4583… (patch)
- github.com/venturedrake/laravel-crm/commit/049fc966029234a6d0f02b69efeabdb16e35… (patch)
- github.com/venturedrake/laravel-crm/commit/78dbf4e41afe48def4037c69d5dd7a348201… (patch)
- github.com/venturedrake/laravel-crm/releases/tag/2.4.0 (release-notes)
- github.com/venturedrake/laravel-crm (product)
Frequently asked questions
- What is CVE-2026-110629?
- CVE-2026-110629 is a medium-severity vulnerability in Venturedrake Laravel-Crm, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-10-14.
- How severe is CVE-2026-110629?
- Medium severity. CVSS v3 base score is 6.5 out of 10.